CVE-2026-86005

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3

Description The administrative BullMQ dashboard is accessible without authentication. This occurs when Redis and BullMQ are enabled and the route is not blocked by a reverse proxy. An unauthenticated remote attacker can access the dashboard via the '/apps/queues' endpoint. This exposure allows the attacker to inspect job payloads and logs, and potentially retry or delete jobs, which impacts the confidentiality, integrity, and availability of queue processing.

Recommendations Update to version 5.2.3. Restrict access to the '/apps/queues' endpoint using a reverse proxy to prevent unauthorized access.